Exiv2
by Exiv2
Source repositories
CVEs (125)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-11531 | Cri | 0.64 | 9.8 | 0.03 | May 29, 2018 | Exiv2 0.26 has a heap-based buffer overflow in getData in preview.cpp. | ||
| CVE-2018-14046 | Hig | 0.57 | 8.8 | 0.02 | Jul 13, 2018 | Exiv2 0.26 has a heap-based buffer over-read in WebPImage::decodeChunks in webpimage.cpp. | ||
| CVE-2018-12265 | Hig | 0.57 | 8.8 | 0.03 | Jun 13, 2018 | Exiv2 0.26 has an integer overflow in the LoaderExifJpeg class in preview.cpp, leading to an out-of-bounds read in Exiv2::MemIo::read in basicio.cpp. | ||
| CVE-2018-12264 | Hig | 0.57 | 8.8 | 0.03 | Jun 13, 2018 | Exiv2 0.26 has integer overflows in LoaderTiff::getData() in preview.cpp, leading to an out-of-bounds read in Exiv2::ValueType::setDataArea in value.hpp. | ||
| CVE-2017-12955 | Hig | 0.57 | 8.8 | 0.02 | Aug 18, 2017 | There is a heap-based buffer overflow in basicio.cpp of Exiv2 0.26. The vulnerability causes an out-of-bounds write in Exiv2::Image::printIFDStructure(), which may lead to remote denial of service or possibly unspecified other impact. | ||
| CVE-2018-14338 | Hig | 0.53 | 8.1 | 0.01 | Jul 17, 2018 | samples/geotag.cpp in the example code of Exiv2 0.26 misuses the realpath function on POSIX platforms (other than Apple platforms) where glibc is not used, possibly leading to a buffer overflow. | ||
| CVE-2018-9305 | Hig | 0.53 | 8.1 | 0.02 | Apr 4, 2018 | In Exiv2 0.26, an out-of-bounds read in IptcData::printStructure in iptc.c could result in a crash or information leak, related to the "== 0x1c" case. | ||
| CVE-2018-9144 | Hig | 0.53 | 8.1 | 0.02 | Mar 30, 2018 | In Exiv2 0.26, there is an out-of-bounds read in Exiv2::Internal::binaryToString in image.cpp. It could result in denial of service or information disclosure. | ||
| CVE-2017-17723 | Hig | 0.53 | 8.1 | 0.02 | Feb 12, 2018 | In Exiv2 0.26, there is a heap-based buffer over-read in the Exiv2::Image::byteSwap4 function in image.cpp. Remote attackers can exploit this vulnerability to disclose memory data or cause a denial of service via a crafted TIFF file. | ||
| CVE-2017-11592 | Hig | 0.49 | 7.5 | 0.02 | Jul 24, 2017 | There is a Mismatched Memory Management Routines vulnerability in the Exiv2::FileIo::seek function of Exiv2 0.26 that will lead to a remote denial of service attack (heap memory corruption) via crafted input. | ||
| CVE-2017-11591 | Hig | 0.49 | 7.5 | 0.03 | Jul 24, 2017 | There is a Floating point exception in the Exiv2::ValueType function in Exiv2 0.26 that will lead to a remote denial of service attack via crafted input. | ||
| CVE-2017-11553 | Hig | 0.49 | 7.5 | 0.02 | Jul 23, 2017 | There is an illegal address access in the extend_alias_table function in localealias.c of Exiv2 0.26. A crafted input will lead to remote denial of service. | ||
| CVE-2017-9953 | Hig | 0.49 | 7.5 | 0.03 | Jun 26, 2017 | There is an invalid free in Image::printIFDStructure that leads to a Segmentation fault in Exiv2 0.26. A crafted input will lead to a remote denial of service attack. | ||
| CVE-2018-17581 | Med | 0.42 | 6.5 | 0.02 | Sep 28, 2018 | CiffDirectory::readDirectory() at crwimage_int.cpp in Exiv2 0.26 has excessive stack consumption due to a recursive function, leading to Denial of service. | ||
| CVE-2018-17282 | Med | 0.42 | 6.5 | 0.02 | Sep 20, 2018 | An issue was discovered in Exiv2 v0.26. The function Exiv2::DataValue::copy in value.cpp has a NULL pointer dereference. | ||
| CVE-2018-17230 | Med | 0.42 | 6.5 | 0.02 | Sep 19, 2018 | Exiv2::ul2Data in types.cpp in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer overflow) via a crafted image file. | ||
| CVE-2018-17229 | Med | 0.42 | 6.5 | 0.02 | Sep 19, 2018 | Exiv2::d2Data in types.cpp in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer overflow) via a crafted image file. | ||
| CVE-2018-16336 | Med | 0.42 | 6.5 | 0.03 | Sep 2, 2018 | Exiv2::Internal::PngChunk::parseTXTChunk in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted image file, a different vulnerability than CVE-2018-10999. | ||
| CVE-2018-11037 | Med | 0.42 | 6.5 | 0.02 | May 14, 2018 | In Exiv2 0.26, the Exiv2::PngImage::printStructure function in pngimage.cpp allows remote attackers to cause an information leak via a crafted file. | ||
| CVE-2018-10999 | Med | 0.42 | 6.5 | 0.02 | May 12, 2018 | An issue was discovered in Exiv2 0.26. The Exiv2::Internal::PngChunk::parseTXTChunk function has a heap-based buffer over-read. |
- risk 0.64cvss 9.8epss 0.03
Exiv2 0.26 has a heap-based buffer overflow in getData in preview.cpp.
- risk 0.57cvss 8.8epss 0.02
Exiv2 0.26 has a heap-based buffer over-read in WebPImage::decodeChunks in webpimage.cpp.
- risk 0.57cvss 8.8epss 0.03
Exiv2 0.26 has an integer overflow in the LoaderExifJpeg class in preview.cpp, leading to an out-of-bounds read in Exiv2::MemIo::read in basicio.cpp.
- risk 0.57cvss 8.8epss 0.03
Exiv2 0.26 has integer overflows in LoaderTiff::getData() in preview.cpp, leading to an out-of-bounds read in Exiv2::ValueType::setDataArea in value.hpp.
- risk 0.57cvss 8.8epss 0.02
There is a heap-based buffer overflow in basicio.cpp of Exiv2 0.26. The vulnerability causes an out-of-bounds write in Exiv2::Image::printIFDStructure(), which may lead to remote denial of service or possibly unspecified other impact.
- risk 0.53cvss 8.1epss 0.01
samples/geotag.cpp in the example code of Exiv2 0.26 misuses the realpath function on POSIX platforms (other than Apple platforms) where glibc is not used, possibly leading to a buffer overflow.
- risk 0.53cvss 8.1epss 0.02
In Exiv2 0.26, an out-of-bounds read in IptcData::printStructure in iptc.c could result in a crash or information leak, related to the "== 0x1c" case.
- risk 0.53cvss 8.1epss 0.02
In Exiv2 0.26, there is an out-of-bounds read in Exiv2::Internal::binaryToString in image.cpp. It could result in denial of service or information disclosure.
- risk 0.53cvss 8.1epss 0.02
In Exiv2 0.26, there is a heap-based buffer over-read in the Exiv2::Image::byteSwap4 function in image.cpp. Remote attackers can exploit this vulnerability to disclose memory data or cause a denial of service via a crafted TIFF file.
- risk 0.49cvss 7.5epss 0.02
There is a Mismatched Memory Management Routines vulnerability in the Exiv2::FileIo::seek function of Exiv2 0.26 that will lead to a remote denial of service attack (heap memory corruption) via crafted input.
- risk 0.49cvss 7.5epss 0.03
There is a Floating point exception in the Exiv2::ValueType function in Exiv2 0.26 that will lead to a remote denial of service attack via crafted input.
- risk 0.49cvss 7.5epss 0.02
There is an illegal address access in the extend_alias_table function in localealias.c of Exiv2 0.26. A crafted input will lead to remote denial of service.
- risk 0.49cvss 7.5epss 0.03
There is an invalid free in Image::printIFDStructure that leads to a Segmentation fault in Exiv2 0.26. A crafted input will lead to a remote denial of service attack.
- risk 0.42cvss 6.5epss 0.02
CiffDirectory::readDirectory() at crwimage_int.cpp in Exiv2 0.26 has excessive stack consumption due to a recursive function, leading to Denial of service.
- risk 0.42cvss 6.5epss 0.02
An issue was discovered in Exiv2 v0.26. The function Exiv2::DataValue::copy in value.cpp has a NULL pointer dereference.
- risk 0.42cvss 6.5epss 0.02
Exiv2::ul2Data in types.cpp in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer overflow) via a crafted image file.
- risk 0.42cvss 6.5epss 0.02
Exiv2::d2Data in types.cpp in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer overflow) via a crafted image file.
- risk 0.42cvss 6.5epss 0.03
Exiv2::Internal::PngChunk::parseTXTChunk in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted image file, a different vulnerability than CVE-2018-10999.
- risk 0.42cvss 6.5epss 0.02
In Exiv2 0.26, the Exiv2::PngImage::printStructure function in pngimage.cpp allows remote attackers to cause an information leak via a crafted file.
- risk 0.42cvss 6.5epss 0.02
An issue was discovered in Exiv2 0.26. The Exiv2::Internal::PngChunk::parseTXTChunk function has a heap-based buffer over-read.
Page 1 of 7